CVE-2026-96806

Published: Ott 16, 2026 Last Modified: Ott 16, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user.

Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0024
Percentile
0,1th
Updated

EPSS Score Trend (Last 5 Days)

613

Insufficient Session Expiration

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
http://www.openwall.com/lists/oss-security/2026/10/15/12
http://www.openwall.com/lists/oss-security/2026/10/15/12
https://github.com/apache/airflow/pull/73695
https://github.com/apache/airflow/pull/73695
https://lists.apache.org/thread/7vwjg3wn8wxkprg6csxcvs6wkh3…
https://lists.apache.org/thread/7vwjg3wn8wxkprg6csxcvs6wkh301r0t